Microsoft Windows Phone 7 does not verify the domain name in the subjects Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Windows_phone_7_firmware | Microsoft | - (including) | - (including) |
Potential Mitigations
Related Attack Patterns
References
- http://osvdb.org/85619
- http://www.kb.cert.org/vuls/id/389795
- http://www.securityfocus.com/bid/55569
- http://www.securitytracker.com/id?1027541
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78620
- http://osvdb.org/85619
- http://www.kb.cert.org/vuls/id/389795
- http://www.securityfocus.com/bid/55569
- http://www.securitytracker.com/id?1027541
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78620